ConnectWise suspends cloud services after Storm-0940 leverages AI agents
Microsoft attributes the breach of 2,250 tenants to a China-aligned group using the ARTEX framework to move through targets in seconds.
By Tunde Bailey ·
ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services following a supply chain attack that touched more than 2,250 Microsoft 365 tenants. The company began a phased restoration process on October 23 and stated it has no indicators that partner backup data was compromised. Microsoft, which identified the threat actor as Storm-0940, said the group used stolen credentials to authenticate directly as ConnectWise applications, bypassing interactive user sign-ins.
The attackers utilized ARTEX, an open-source agentic AI penetration testing framework, to accelerate the intrusion. Microsoft described ARTEX as a system of large language model-driven agents capable of running autonomous penetration tests. The framework sped up scanning, reconnaissance, password spraying, and the abuse of OAuth applications. Because these agents operate continuously with minimal human input, defenders faced a compressed window to detect and respond to the activity.
Storm-0940 has been active since 2021 and is designated as a China-state-aligned threat actor without known industry aliases. The campaign targeted 14 industries, including aerospace and defense, semiconductors, government agencies, and think tanks. Microsoft clarified that the attack did not stem from a vulnerability in its own systems, products, or services. The group used four specific application credentials to sign in to customer tenants from the same IP range, recording over 200 sign-ins in under four minutes.
Within compromised tenants, the AI agents performed Graph and directory operations, conducted reconnaissance, and modified application credentials, identities, groups, and privileged roles. Huntress, a security firm, observed one tenant on October 15 where an app added itself to the Global Administrator role. This action triggered a Microsoft Defender alert for "Application self-assigned Global Administrator role." The attackers also planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins at 162 tenants, a number that rose to nearly 1,000 Entra tenants with activity from the attacking IP the following day.
The attackers moved through the tenant list in sorted order, with entries separated by seconds, which Huntress suggested indicated a script working from a target list. A parallel password-spraying effort targeted 327 accounts across eight organizations, generating more than 151,000 failed logons. At its peak on October 11, the spray reached 2,900 attempts per minute. Nearly 98% of this activity resulted in account lockouts, and no successes were recorded in that specific phase of the operation.
The use of ARTEX distinguishes this campaign from traditional attacks, as the framework can work with any AI model. Public reporting this month linked the tool to breaches at South Korean financial institutions. CrowdStrike stated the suspect in those separate attacks was likely based in China and allegedly used ARTEX with Anthropic's Claude Code. Reuters reported that ARTEX's developer, known as "Autumn-27," announced on GitHub that the project would stop being updated and become closed source.
Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued. The company also recommended that organizations review activity from this month where logs permit. Microsoft cautioned that an affected app or a successful sign-in does not necessarily mean data was accessed or taken. The company stressed that the activity originated from a compromise of ConnectWise applications rather than a flaw in Microsoft's infrastructure.
ConnectWise detected the unauthorized access and paused services as a precaution. The company expects the phased restoration to take several days. It remains unclear how the initial ConnectWise credentials were obtained or the exact number of tenants that were fully compromised, although Microsoft attempted sign-ins at over 2,250 tenants. Some intrusions reached privileged access less than three hours after initial targeting.
